2Checkout 2FA: how to set up an authenticator app for the Merchant Control Panel
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
2Checkout's two-factor authentication (2FA) protects the Merchant Control Panel, where sellers manage products, orders and their team's logins. It isn't fully optional: you need it turned on before you can add or edit anything in the panel's Settings area (2Checkout).
There are two methods: codes from an authenticator app (2Checkout's help names Google Authenticator) or codes by email. The master account, the main login that manages the other users, can only use the app (2Checkout). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app that scans a QR code works the same way.
How we checked this guide: the 2Checkout steps come from 2Checkout's own documentation site, linked below, which we read on October 21, 2026. We haven't tested them on a 2Checkout account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
App or email: who gets which
- Master account: authenticator app only.
- Other users: the app, set up the same way, or email codes. Only the master account can switch on email codes for a user, for example someone who can't keep a phone at their desk, and that user can't turn them off (2Checkout).
The master account does this under Settings > User management: click Edit next to the user, check Two-factor authentication by email and click Save. Unchecking the box turns it off (2Checkout).
Turn on 2FA with an authenticator app
These steps are for your own login, whether it's the master account or another user (2Checkout):
- Sign in to the Merchant Control Panel at secure.2checkout.com/cpanel.
- Click the Settings cogwheel at the top right, then My details.
- Open the Two-factor authentication tab. 2Checkout shows a QR code and a text key it calls the Authentication secret.
- In Novaz, tap +, then Scan QR code, and point the camera at the code on your computer screen. If the panel is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If scanning doesn't work, tap +, then Enter key manually in Novaz, and type the Authentication secret as the Setup key. See What is a 2FA setup key?
- Type the code Novaz shows into the field on the panel and click Activate.
2Checkout's help doesn't give the code length or interval. Scanning is safer, because the QR code carries those settings; a typed key always gets 6 digits every 30 seconds in Novaz.
What changes after you activate it
From then on, every sign-in to the panel asks for a code from your app after your username and password (2Checkout). The help doesn't mention a way to trust a device and skip the code.
If your company uses 2Checkout's Universal SSO, password sign-in is switched off and you sign in through your organization's identity provider (2Checkout). The documentation doesn't say how the panel's own 2FA fits with SSO.
There are no backup codes to save
2Checkout's documentation doesn't mention backup or recovery codes, or any fallback for the master account. Novaz keeps its keys on your iPhone, so unless you've turned on iCloud backup or exported a backup file in Settings › Backup, that iPhone is your only source of codes. Read the lost-phone section below before you need it.
If 2Checkout rejects your code
The documentation has no advice on wrong codes. The usual cause is a drifting phone clock: on iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Moving to a new iPhone
2Checkout only documents Activate and Deactivate, so switching phones means turning 2FA off and setting it up again. While you still have the old phone, go to Settings > My details > Two-factor authentication, click Deactivate, then go through the setup steps with the new phone (2Checkout). Do both in one sitting, since the Settings area needs 2FA on. If you have a Novaz iCloud backup or backup file, you can restore the account on the new iPhone and skip this. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
2Checkout's documentation doesn't describe recovery from a lost authenticator app, what proof it asks for, or how long it takes. It lists tickets and live chat inside the panel, and email to Merchant Technical Support at supportplus@2checkout.com (2Checkout, 2Checkout). Once you're locked out, email is the route you can still use.
If someone else holds the master account, ask them too. They manage users under User management, though the help doesn't say they can clear another user's authenticator app. More in Lost the phone with your authenticator app?
Turning 2FA off
Under Settings > My details, open the Two-factor authentication tab and click Deactivate (2Checkout). Then open the entry in Novaz and tap Remove account. Email codes set by the master account can only be removed by the master account.
